Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/01/2025, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
New Order Inquiry.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
New Order Inquiry.exe
Resource
win10v2004-20241007-en
General
-
Target
New Order Inquiry.exe
-
Size
994KB
-
MD5
6731b5df6330f9985ff98363800962dc
-
SHA1
308778a3bbafd1bb5b1d7d8bab7801ffd04d2955
-
SHA256
f7e621225671ac8ad38c562c75005271fc1a829343d4a3358ce20988985c5ab5
-
SHA512
ce479e75632c2e470eb84cdb42e94534bb21975124dd3f166f9a5aecd62cff3ebf37ee9bb3e4c7110fd23782c2798ced8559ba6b3f5d57b01c6d512d1bb02c0b
-
SSDEEP
24576:x4FXOPkfKVH2Ix+fPFGuR6BdNoLZT/dZGeBdgE7E8D:y9yVHQftTm8ZT1/dD7E8D
Malware Config
Extracted
remcos
RemoteHost
80.76.51.19:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2XABUM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2376 set thread context of 1752 2376 New Order Inquiry.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Order Inquiry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Order Inquiry.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2376 New Order Inquiry.exe 2376 New Order Inquiry.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2376 New Order Inquiry.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2056 2376 New Order Inquiry.exe 31 PID 2376 wrote to memory of 2056 2376 New Order Inquiry.exe 31 PID 2376 wrote to memory of 2056 2376 New Order Inquiry.exe 31 PID 2376 wrote to memory of 2056 2376 New Order Inquiry.exe 31 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32 PID 2376 wrote to memory of 1752 2376 New Order Inquiry.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\New Order Inquiry.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\New Order Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\New Order Inquiry.exe"2⤵PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\New Order Inquiry.exe"C:\Users\Admin\AppData\Local\Temp\New Order Inquiry.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1752
-